The All-in-One WP Migration and Backup plugin for WordPress suffers from an information exposure vulnerability (CWE-200) in versions up to 7.86. Publicly accessible log files disclose sensitive data, including full paths, to unauthenticated actors. The vulnerability has a CVSS 3.1 base score of 5.3, reflecting a network attack vector with low complexity and no privileges required. No known exploits are reported in the wild, and no official patch or fix has been documented in the provided data.

An unauthenticated attacker can view sensitive information such as full file system paths through exposed log files. This information disclosure could aid attackers in reconnaissance but does not directly affect data integrity or system availability. No evidence of active exploitation is known at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict public access to log files generated by the plugin to prevent unauthorized information disclosure. Monitor for vendor updates and apply patches promptly when released.